Some VW & Audi Cars are Vulnerable to Remote Hacking

[Eric at Pelican Parts]

Newer cars has so much technology in them which could be both a blessing and a curse. A Dutch cyber security firm found out that some models are vulnerable to remote hacking, such as the Golf GTE and Audi A3 Sportback e-tron. They used the vehicle's wifi connection to gain access to the vehicle's In-Vehicle Infotainment system, which then let them gain further access into other data.

"Under certain conditions attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and the conversation history," Computest researchers said.


"Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time," researchers added.

Keuper and Alkemade say the IVI system is also indirectly connected to the car's acceleration and braking system, but they stopped investigating the possibility of interacting with those systems fearing they might breach Volkswagen's intellectual property.

All in all, besides the WiFi attack vector that allowed remote access to a car's IVI, researchers also found other flaws that could be exploited via USB debugging ports located under the car dashboard.

Volkswagen did say they worked with the research team to address the flaws, but the researchers are a bit skeptical still.

But albeit Volkswagen closing the vulnerability in current infotainment systems, researchers are still worried. This is because the IVI system they hacked did not come with an over-the-air update system, meaning it couldn't be updated with a software patch from afar.

Furthermore, in their conversations with Volkswagen, researchers say the car maker alluded to having fixed the IVI flaws in infotainment systems still in production, but without telling researchers how they planned to deal with cars already sold to customers.

Read the full article here